Lucene search

GitHub Advisory DatabaseGHSA-G44M-X5H7-FR5Q

HistoryApr 09, 2024 - 6:30 p.m.

Apache Zeppelin: Cron arbitrary user impersonation with improper privileges

2024-04-0918:30:22

CWE-20

CWE-862

GitHub Advisory Database

github.com

apache zeppelin

cron

input validation

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

Improper Input Validation vulnerability in Apache Zeppelin.

The attackers can call updating cron API with invalid or improper privileges so that the notebook can run with the privileges.

This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.

Users are recommended to upgrade to version 0.11.1, which fixes the issue.

Affected configurations

Vulners

Node

org.apache.zeppelin\zeppelinMatchserver

CPENameOperatorVersion
org.apache.zeppelin:zeppelin-serverlt0.11.1

CPE	Name	Operator	Version
	org.apache.zeppelin:zeppelin-server	lt	0.11.1

www.openwall.com/lists/oss-security/2024/04/09/9

github.com/advisories/GHSA-g44m-x5h7-fr5q

github.com/apache/zeppelin/commit/49e2740a1d83d58d2401ccf175fc91ffebfb0892

github.com/apache/zeppelin/pull/4631

lists.apache.org/thread/slm1sf0slwc11f4m4r0nd6ot2rf7w81l

nvd.nist.gov/vuln/detail/CVE-2024-31865